diff options
| author | Michael Jennings <mej@kainx.org> | 2008-05-14 23:16:54 +0000 |
|---|---|---|
| committer | Michael Jennings <mej@kainx.org> | 2008-05-14 23:16:54 +0000 |
| commit | 883b2660af38b96403559ec253401feca03927a6 (patch) | |
| tree | f1ba7281dd0fdde95b3cbae493929fabe66246f4 /ChangeLog | |
| parent | 1b91d073181cc17cd057d4449e5ae407976f87a9 (diff) | |
| download | eterm-883b2660af38b96403559ec253401feca03927a6.tar.gz | |
Wed May 14 16:09:04 2008 Michael Jennings (mej)
(Correct) fix for CVE-2008-1692. Eterm no longer defaults to using
":0" for $DISPLAY due to the possibility that an attacker can create a
fake X server on a shared system, intercept the Eterm X connection,
and send fake keystrokes to the victim's Eterm to execute arbitrary
commands as that user.
The previous fix, while it did indeed correct the vulnerability, broke
the --display option. The original fix from Bernhard Link was more
correct, albeit not quite on target.
----------------------------------------------------------------------
SVN revision: 34574
Diffstat (limited to 'ChangeLog')
| -rw-r--r-- | ChangeLog | 12 |
1 files changed, 12 insertions, 0 deletions
@@ -5565,3 +5565,15 @@ Wed May 14 15:26:13 2008 Michael Jennings (mej) Patch from Emmanuel Anne <emmanuel.anne@gmail.com> to fix cut/paste with KDE applications. ---------------------------------------------------------------------- +Wed May 14 16:09:04 2008 Michael Jennings (mej) + +(Correct) fix for CVE-2008-1692. Eterm no longer defaults to using +":0" for $DISPLAY due to the possibility that an attacker can create a +fake X server on a shared system, intercept the Eterm X connection, +and send fake keystrokes to the victim's Eterm to execute arbitrary +commands as that user. + +The previous fix, while it did indeed correct the vulnerability, broke +the --display option. The original fix from Bernhard Link was more +correct, albeit not quite on target. +---------------------------------------------------------------------- |